79 matches found
📄 Juniper JunOS 23.4 Module Scanner / Exploitation Framework
This PHP script is a modular scanner and exploitation framework targeting Juniper JunOS CVE‑2023‑36846, an arbitrary file upload vulnerability due to missing authentication.. It is designed with a clear separation of responsibilities and supports single‑target testing, interactive exploitation, a...
EUVD-2013-2076
Malware in sbrugna...
EUVD-2009-2932
Malware in sbrugna...
EUVD-2012-0406
Malware in sbrugna...
VulnCheck KEV: CVE-2024-21620
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's...
CVE-2025-46341
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the "Remote-User" header or the "X-WebAuth-User" header by making specially crafted requests via the add feed functionalit...
CVE-2025-46341: Server-Side Request Forgery (SSRF)
FreshRSS is a self-hosted RSS feed aggregator. Prior to version 1.26.2, when the server is using HTTP auth via reverse proxy, it's possible to impersonate any user either via the Remote-User header or the X-WebAuth-User header by making specially crafted requests via the add feed functionality an...
CVE-2013-2106
webauth before 4.6.1 has authentication credential disclosure...
CVE-2009-2945
weblogin/login.fcgi aka the WebLogin login script in Stanford University WebAuth 3.5.5, 3.6.0, and 3.6.1 places passwords in URLs in certain circumstances involving conversion of a POST request to a GET request, which allows context-dependent attackers to discover passwords by reading 1 web-serve...
PT-2024-5665 · Tenda · Tenda I22
Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: The issue is related to a buffer overflow in the formApPortalWebAuth function due to lack of input size validation. This can be exploited by a remote attacker to impact the confidentiality, integrity...
PT-2023-6520
Name of the Vulnerable Software and Affected Versions Juniper Junos OS SRX Series versions 21.2 prior to 21.2R3-S8 Juniper Junos OS SRX Series versions 21.4 prior to 21.4R3-S6 Juniper Junos OS SRX Series versions 22.1 prior to 22.1R3-S5 Juniper Junos OS SRX Series versions 22.2 prior to 22.2R3-S3...
VulnCheck KEV: CVE-2023-36851
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauthoperation.php that doesn't require authentication, an...
grafana: Escalation from admin to server admin when auth proxy is used
A flaw was found in the grafana package. Auth proxy allows authentication of a user by only providing the username or email in an X-WEBAUTH-USER HTTP header. The trust assumption is that a front proxy will take care of authentication and that the Grafana server is only publicly reachable with thi...
CVE-2022-35957
A flaw was found in the grafana package. Auth proxy allows authentication of a user by only providing the username or email in an X-WEBAUTH-USER HTTP header. The trust assumption is that a front proxy will take care of authentication and that the Grafana server is only publicly reachable with thi...
OPENSUSE-SU-2020:1652-1 Security update for nextcloud
This update for nextcloud fixes the following issues: nextcloud version 20.0.0 fix some security issues: - NC-SA-2020-037 PIN for passwordless WebAuthm is asked for but not verified - NC-SA-2020-033 CVE-2020-8228 Missing rate limit on signup page - NC-SA-2020-029 CVE-2020-8233, boo1177346...
CVE-2013-2106
webauth before 4.6.1 has authentication credential disclosure...
CVE-2013-2106
webauth before 4.6.1 has authentication credential disclosure...
Design/Logic Flaw
webauth before 4.6.1 has authentication credential disclosure...
